Update: Register CORS plugin via server.pre() to make sure it runs before any routes